[jira] [Created] (ARROW-10400) Propagate TLS client peer_identity when using mutual TLS

["Radu Teodorescu (Jira)" <ji...@apache.org>]

Radu Teodorescu created ARROW-10400:
---------------------------------------

             Summary: Propagate TLS client peer_identity when using mutual TLS
                 Key: ARROW-10400
                 URL: https://issues.apache.org/jira/browse/ARROW-10400
             Project: Apache Arrow
          Issue Type: Improvement
          Components: C++, FlightRPC
            Reporter: Radu Teodorescu


In the context of mutual TLS the client is authenticated at TLS level and the client identity is available in the grpc context’s authentication context but that information is not propagated to the peer_identity in the arrow flight context.
This is because Flight has its own authentication mechanism and the TLS client authentication was added afterwards without connecting the two.

I suggest the following change to mediate the above:

In the case where the client is authenticated by the GRPC/TSL layer, I can have the flight_context.peer_identity default to the PeerIdentity as stored in the grpc auth_context. 
Pros: it’s a 4 line change and it would work out of the box for both python and C++ with no public interface changes and no relevant observed behavior for existing code (except for peer_identity context field being properly populated instead of empty).
Cons: If there is a flight Authentication Handler, the lower level identity would be ignored (but that is the case in the current implementation already).



--
This message was sent by Atlassian Jira
(v8.3.4#803005)